Wordpress“esc ..”函数是否有任何反转功能？

Question

I'm using the standart "esc_html" in Wordpress for insert data (textarea) to the db.

All works nice but how can I reverse the text?

For example:

I insert the text - You ready?! Let's go!

And in the db it's as I expected save it as - You ready?! Let's go!

Later, when I tried to display this text in my tooltip it's also display the text as You ready?! Let's go!

Please, I would like to know if there is any reverse for this function since I tried to use htmlspecialchars_decode() and realized it's not the same function.

Thanks!

Answer 1

The answer is: generally speaking, you don't escape data when saving it to the database. You sanitize it. (And so you don't really need to worry about "reverting" the content from esc_* functions).

You sanitize the input data when you're about to insert it into the database to prevent SQL injection attacks. If you're using the insert() method from the $wpdb object or the wp_insert_post() function to create a new post/page, then the sanizitation is done for you automatically.

If you're writing a custom query (eg. $wpdb->query( "INSERT INTO table VALUES('a string', 'another string', '2018-09-21 10:35:52')" );) then you need to use the prepare() method to sanitize the query before running it (eg. $wpdb->query( $wpdb->prepare( "INSERT INTO table VALUES(%s, %s, %s)", array($string1, $string2, $date_string) ) );).

When you're about to display the data on screen use any of the different esc_* functions to make sure nothing malicious is being printed on screen (like <script>alert('Hello!');</script>).